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Abstract 

00 . 

In this paper, we consider a quantum key distribution protocol (QKD) with two- 
• way classical communication that is assisted by one-time pad encryption. We propose 

a two-way preprocessing that uses one-time pad encryption by previously shared se- 
cret key, and the net key rate of the QKD with proposed preprocessing exceeds the 
Oh, key rate of the QKD without it. The preprocessing is reduced to the entanglement 

distillation protocol with two-way classical communication and previously shared EPR 
pairs (two-way breeding protocol) , and the security of QKD with the preprocessing is 
guaranteed in the same way as Shor and Preskill's arguments. 

keyword: quantum key distribution, entanglement distillation protocol, two-way clas- 
sical communication, one-time pad encryption 
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■ 1 Introduction 



Quantum key distribution (QKD) provides a way for two parties Alice and Bob 
to share an unconditional secure key in the presence of an eavesdropper Eve. 
Unlike conventional schemes of key distribution that rely on unproven compu- 
tational assumptions, the security of QDK is guaranteed by the principles of 
quantum mechanics. Since an unknown quantum state cannot be cloned per- 
fectly, any eavesdropping attempt by Eve will disturb the transmitted quantum 
states. Thus, by estimating the error rate of the transmitted quantum states, 
Alice and Bob can estimate an amount of eavesdropping. Then, by procedures 
such as the error correction and the privacy amplification, Alice and Bob distill 
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the final secure key from the raw key whose partial information is known to 
Eve. The best-known QKDs are the Bennett-Brassard 1984 (BB84) protocol [T] 
or the six-state protocol The security of the BB84 protocol was proved in 
0] Ej) and a simple proof was shown by Shor and Preskill in m which the 
security of the protocol is proved by relating the protocol to the entanglement 
distillation protocol (EDP) PJEIEII via Calderbank-Shor-Stean (CSS) quantum 
error correcting code After that, the security of the six-state protocol 

was proved in |14| . 

In addition to the security of QKD, it is important to increase the key rate 
of the QKD, where the key rate is defined by the ratio of the length of the 
final secure key to the length of the raw key. In [H], a preprocessing with two- 
way classical communication was proposed in order to increase the key rate 
or the tolerable error rate of the QKD, where the tolerable error rate is the 
error rate at which the key rate becomes zero. The security of QKD with two- 
way preprocessing is proved by relating the protocol to the EDP with two-way 
classical communication. By this preprocessing, the key rate of the QKD is 
increased when the noise of the channel is rather high. Indeed, the tolerable 
error rate of the BB84 protocol is increased from 11 % to 18.9 %, and that of 
the six-state protocol is increased from 12.7 % to 26.4 %. Later, it was shown 
that the BB84 protocol can tolerate 20.0 % error rate and the six-state protocol 
can tolerate 27.6 % error rate in jjj. Since the distillation rate of the known 
two-way EDPs exceed that of one-way EDPs only when the fidelity between an 
initial mixed state and the EPR pair is rather low |3] , the two-way preprocessing 
in the QKD is effective only when the error rate of the channel is rather high. 

In JHj) a new type of two-way EDP was proposed. This protocol uses pre- 
viously shared EPR pairs as assistant resource, and the distillation rate of this 
EDP exceeds that of one-way EDPs for whole range of the fidelity. Motivated by 
|18|. we propose a two-way preprocessing for QKD that uses one-time pad en- 
cryption by previously shared secret key. The proposed preprocessing is related 
to the two-way EDP with previously shared EPR pairs, and the security of the 
QKD with proposed preprocessing is guaranteed in the same way as jHlEj. The 
advantage of the proposed preprocessing is that the net key rate of the QKD 
with proposed preprocessing exceeds the key rate of one-way QKD even when 
the error rate of the channel is rather low, where the net key rate is defined 
by the key rate subtracted by the ratio of the length of the consumed secret 
key in the protocol to the length of raw key. It should be noted that the use of 
one-time pad encryption in the QKD is already proposed in the literature |1 1 j in 
order to simplify the analysis of the security. In contrast to |llj , we introduced 
one-time pad encryption in order to increase the net key rate of the QKD. 

The rest of this paper is organized as follows. In Section |3 we present the 
notations used throughout this paper (Section I2.1JI and review known QKD 
protocols fSection l2.2|) . In Section|31 we propose general two-way preprocessing 
that uses one-time pad encryption, and show the security of the QKD with 
proposed preprocessing. In Section^ we present a specific instance of proposed 
preprocessing, and for six-state protocol we compare the net key rate of the 
QKD with proposed preprocessing, the key rate of the QKD with only one- 
way classical communication, and the key rate of the QKD with conventional 
two-way preprocessing. 
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2 Preliminaries 



2.1 Notations 

In this section, we present the notations used throughout this paper. We de- 
note two-dimensional Hilbert space (qubit) by Ti. In this paper, we use three 
orthonormal bases of H: {|0},|1}}, {|0) = ^(|0) + |1)),|T) = ^(|0) - |1))}, 

and {|S) = ^=(|0) + |T) = ^=(|0) - For a two-qubits Hilbert space 

7-t® 2 =H®H, there exists four maximally entangled states called Bell states: 
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The projectors onto these Bell states are denoted by = \ipij)(ipij\- For 
vectors a — {at, . . . , a n ) and b = (bt, . . . , b n ), \ip2b) represents 

\lpaibi) ® ••• ® |^a„6„)- 

The projector onto |-0™ b ) is denoted by P" b = |V£ b )(CJ- 

For a probability distribution {pi}™ 1; X}i=iPi = 1, H{p\, . . . ,p m ) is the 
entropy function defined by H (pi, . . . ,p m ) = 5Z»=i l°gKj where the base of 
log is 2. For an m-tuple of non-negative numbers with YliLtPi = 

ff[pi, . . . ,Pm] denotes the entropy of the normalized probability distribution, 
i.e., H\pt, . . . ,p m ] = H{pt/P, . . . ,p m /P). 

2.2 Known protocols 

In this section, we review known protocols: the QKD with one-way classical 
communication, and the QKD with the two-way preprocessing, and the security 
of those protocols [HlElEj- The prepare and measure QKD protocols consist of 
two phases, the quantum transmission phase and the key distillation phase. In 
the quantum transmission phase, the sender Alice sends a random bit sequence 
by sending quantum states, with {|0), |1)} basis or {|0), |1)} basis in the BB84 
protocol, and with {|0), |1)} basis, {|0), |1)} basis, or {|0), |1)} basis in the six- 
state protocol. Then, revealing part of shared bit sequences, Alice and Bob 
estimates error rates. If estimated error rates are too high, then they abort the 
protocol. In the end of this phase, Alice and Bob get raw keys respectively. In 
the following, we consider the raw key x that is transmitted by {|0), |1)} basis, 
but the final secure key can be distilled from the raw keys that are transmitted 
in other bases in the same way. The key distillation phase is further divided 
into three part: 

Two-way preprocessing Alice and Bob perform preprocessing in order to 
separate the raw key into two groups, one with higher bit error rate and 
one with lower bit error rate. 
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Error correction Alice and Bob eliminate the disagreement between Alice 
and Bob's raw keys by an error-correcting code. 

Privacy amplification Alice and Bob reduce the leaked information about 
the raw key to Eve by shortening the raw key into a shorter bit sequence 
with a hash function. 

Finally, Alice and Bob share a secret key k. 

The security of the final secret key k is shown as follows. When Alice sends 
a randomly chosen raw key x — (xi, . . . , x n ) € F£ by transmitting the quantum 
state \x) := \x\) ® • • • ® \x n ) to Bob, Bob receive a state p B and Eve has a state 
p E = Ttb\xbe)(xbe\, where \xbe) is a purification of p B in Bob's system 
Hb = H® n and Eve's system He- In Eve's point of view, this situation can 
be regarded as follows by using a quantum state on Alice's system Ha = H® n , 
Bob's system Hb and Eve's system He'- 

^ = i^|x)(xMpf, (1) 

where p BE = \xbe) {xbe\- Then, Eve has the system He of the state p E = 
TtabP ABE - 

Let tripartite state \^abe) be 



I^abe, o 



X — £ \x) a ®\x)be- (2) 



a;eF" 



Even if we assume that the state in Alice, Bob, and Eve's systems is \^abe) in- 
stead of p ABE , there is no difference in Eve's point of view, since Tr ab\^abe) (^abe\ 
p E . Furthermore, we can assume that the state o AB = TteY^abe) (^abe\ is 
diagonal in the Bell basis, i.e., 



a AB 



E P -Ar ab ){r ab \, E p ^» = 1 ( 3 ) 



by the following reason 0J^J. If a AB is not diagonal in the Bell basis, then 
we can perform twirling 011], and providing ancilla systems for twirling to Eve 
increases her information. 

According to the security proof of [HI Ejj Eve's information about k is 
negligible if Alice and Bob can distill a bipartite state almost close to the perfect 
EPR pairs 

l«) = 7Pr E \ k )A®\k) B 

from the mixed bipartite state a AB by the EDP corresponding to the two-way 
preprocessing, the error correction, and the privacy amplification. 



3 Preprocessing with one-time pad encryption 

In this section, we propose new preprocessing that uses two-way classical com- 
munication and one-time pad encryption by previously shared secret key. Then, 
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we show the security of the proposed preprocessing by reducing the proposed 
preprocessing to the two-way EDP with previously shared EPR pairs. 

When Alice and Bob have raw keys x and x respectively, our new prepro- 
cessing is executed as follows. Alice calculates parities xM T g F2 for a parity 
check matrix M and sends it encrypted by previously shared secret key s G ¥ l 2 , 
i.e., Alice sends xM T + s, where M T denotes the transpose of the matrix M. 
Then, Bob subtracts s from xM T + s, and calculates parities t = (x — x)M T 
and sends it to Alice without encryption. The information t — (x — x)M T 
can be used in the subsequent processings: the error correction and the privacy 
amplification. The main difference between this preprocessing and the conven- 
tional two-way preprocessing [H] is that the information about Alice's raw key 
is not revealed. 

This preprocessing is reduced to the two-way EDP with previously shared 
EPR pairs as follows. In Eve's point of view, above situation can be regarded as 
follows by using a quantum state on Alice's system Ha, Bob's system Hb and 
Eve's system He- Before the preprocessing, the state is of the form Eq. In 
the preprocessing, Bob will obtain a parity t with probability 

P t]x = Tr [(U Xtt (8 I E )p* B (n x , t ® I E )] , 

where He t is a projection operator defined by 

n x ,t = ^ \x + u)(x + u\, 

uM T =t 

and Ie is the identity operator on He- Since we assumed a AB is of the form 
Eq. ©, P t i x does not depends on x, thus we denote P t \ x by P t . Since the 
parities of the difference of Alice and Bob's raw key, t = (x— x)M T , is revealed 
to Eve, in Eve's point of view the state of Eq. Q becomes 

p? BE =±j:\x){x\A®p* E t , (4) 

where 

Pll - jr<P«,t ® I e)p B ® Ie). 

Then, Eve has the system He of the state pf = TrABPt BE — J2xe¥" 2»pfti 
where p% t = Tr B pf f . 

This preprocessing is equivalent to the following two-way EDP that uses 
previously shared EPR pairs as ancilla. Alice and Bob start from the state of 
the form Eq. (J2J) . Alice and Bob perform parity check by CNOT operation with 
a AB as source qubits and ancilla EPR pairs IV'oo) as target qubits. Specifically, 
if the (i, j) element of M is 1, then Alice and Bob each perform CNOT 
operation with j-th qubit pair of a AB as source qubits and i-th ancilla EPR 
pair as target qubits. After performing CNOT parity check, Alice and Bob 
measure the ancilla EPR pairs with {|0),|1)} basis and get a measurement 
results a,b e¥ 1 2 respectively. Then, they compare a and b by two-way classical 
communication and get the difference of the parity t. Here, the state of Eq. (J2J 
becomes, ignoring the normalization, 

Wabe) = (n t ® Ie)\^abe), 
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where lit is a projection operator defined by 



n*= E p ™, 



uM T =t 

which is the projector onto the Bell states that causes parities t. From the 
relation 

Poo + Poi = |00)(00| + |11)(11|, 
P10 + P11 = |01)(01| + |10)(10|, 



we have 



n 

uv 



uM T —t 



E E 

uM T =t 
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= Ei y >< y i® n ^- 

Thus, we have 

Tr|* ABB )(* ASJ5 | = Tr(n t <g> /is)|*ABi3)(*Ai?£;|(n t <g> 7 B ) 
= Trl E lv><vl®H»,t®^) |*Ams><*AiHs| E li/Xv 7 !® 11 !*',*®^ 



Tr ^r E l y )( y 'l® (n w ,t®/B)|vBB><w , B £l(n»',t®/B) 

y,l/'eF™ 
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3/GFJ 

= Ft- 

Thus, is normalized to 



\$ABE) = -^=(tt t ®I E )\y AB E)- 
V 



Then, Eve has the system He of the state 
TrAB | *^ib_e) (^abe I 



= Tr ^ E ^(n»,t®/s)pf £ (iW®^) 

xGFJ * 
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which is same as the state in the QKD. Consequently, combining with the argu- 
ment in Section 12.21 a secret key that is derived by the proposed preprocessing 
followed by the two-way preprocessing, the error correction, and the privacy 
amplification is secure, if Alice and Bob can distill a state almost close to the 
perfect EPR pairs by the EDP with previously shared EPR pairs followed by 
the EDP corresponding to the two-way preprocessing, the error correction, and 
the privacy amplification. 

4 Six-state protocol with proposed preprocess- 
ing 

In this section, we present a specific instance of the preprocessing proposed in 
Section^ and calculate the net key rate of the six-state protocol with proposed 
preprocessing, where the net key rate is the ratio of the net key length to the 
length of the raw key, and the net key length is the difference between the 
length of the final secure key and the length of the secret key consumed in the 
preprocessing. Our protocol is executed as follows. 

(1) Alice prepares N qubits randomly chosen from |0), |1), |0), |1), |0), and |1) 
and sends them to Bob. Bob acknowledges the receipt of the qubits and 
measures them randomly along one of the following three bases: {|0), |1)}, 
{|0),|T)}, and {|U),|T)}. Using the correspondence that |0), |0), and |S) 
represent while |1), |1), and |T) represent I, Alice and Bob convert their 
preparation and measurement results into binary sequence. Then, Alice 
and Bob announce the bases they used to prepare and measure each qubit. 
They keep only those bits that are prepared and measured in the same 
basis. 

(2) Alice and Bob divide their remaining binary sequence into three sets ac- 
cording to their basis of measurement. They randomly pick test bits from 
each set and publicly compare the preparation and measurement results. 
Then they get the ratios of errors pz, px, and py in each test bits. If 
these error rates are too high to distill the secure key, then they abort the 
protocol. They calculate qx, qz, and qy from the relations pz = qx + , 
Px — qz + Qy , and py = qx + qz- The ratios of X errors, Z errors, and Y 
errors in untested qubits are close to qx, qz, and qy with high probability. 
If Alice and Bob perform a processing that are secure for any uncorrelated 
Pauli channels with error rates close to {qx,qy,qz), then the security of 
the final key distilled by the processing is guaranteed Lemma 3]. 

(3) They distill the final secure keys from raw keys, that is, the binary se- 
quences that are not revealed in step ||2J). In the following, we consider 
the raw key x that is transmitted by {|0),|1)} basis, but we can distill 
secure keys from raw keys that are transmitted by other bases in the same 
way. Alice converts the raw key x — (x\, . . . , x n ) into c = (ci, . . . , c„/ 2 )j 
where Cj = x^i-x ® a?2i- Then, she calculates parities cM T £ F 2 for ~ x I 
parity check matrix M. Then she sends cM T + s £ F 2 to Bob, where 
s is a previously shared secret key. Similarly, Bob converts the raw key 
x = {xi, . . . , x n ) into c = (ci, . . . , c„/ 2 ), where Cj = X21-1 ® xn- Then he 
calculates parities cM T — cM T and sends it to Alice. Since c — c can be 
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regarded as a binary error sequence with error rate P dd — 2pz(l — Pz), 
Alice and Bob can identify c — c from I ~ ~H(P even , P dd) parities |2lll8|. 
where P even = 1 — P dd- Thus, Alice and Bob can know which blocks of 
length 2 of x — x has an even parity (00 or 11), or an odd parity (01 or 
10). 

(4) Let x e and x e be sequences that consist of the blocks with even parities. 
For x e and x e , Alice and Bob perform the error correction with a linear 
code C\ and the privacy amplification with a linear code C2, and get the 
final key in the same way as [T3IIT7)] . 

(5) For each blocks with odd parities, Alice and Bob announce the first bit of 
each blocks. Then, Alice and Bob can identify the errors in the second bit 
of each block, and Bob can correct them. Let Xq and Xq be sequences that 
consist of second bit of blocks with x^i-i © abi-i = 0, and X\ and X\ be 
sequences that consist of second bit of blocks with x%\-\ © £21-1 = 1. 

(6) Since there is no more errors in Xq and X\, Alice and Bob can distill final 
secret keys only by the privacy amplification. 

Each step of above protocol has the following meaning. Step 101 is two-way 
preprocessing with one-time pad encryption. Step © belongs to the class of 
conventional two-way preprocessing and this step is reduced to the EDP 
in which Alice and Bob measure Z ® I for each blocks of qubits respectively. 
Steps |J2J and © are conventional error correction and privacy amplification. 
The equivalent EDP of this protocol is the EDP proposed in ^B]- The net key 
rate of this protocol is exactly the same as the distillation rate of the EDP in 
|18j . which is calculated as follows. The length of the secret key consumed in 
step (0 is ^H(P even , P dd)- The length of the key that is distilled in step @ 

is " P 2" e " (2 - H[q},qiq z ,qzqi,qzfQx'9xqY,qYqx,qY})' wner e qi = 1 - qx - 
1y — qz- The length of the key that is distilled from xq and x\ in step © is 
- H[q Xl qY}) and "£^(1 - H[ qi ,q z ]) respectively. Thus the net key 

rate is 

- 1 even /„ n r 2 2 2 2 n 

—^—(2 - ^[q^qiqz^zqi, q z ,q x ,QxqY, qYqx,q Y \) 

+ (1 - H[q x ,q Y ]) + - H[qj, qz}) - \lI(P even , P odd ) 

= l-H{qi,qx,qz,qY) + -^{H[qi,qz\+H[q x ,qY]}- (5) 

The net key rate of Eq. © exceeds the key rate 1 — H(qi,q x ,qz,qY) of the 
six-state protocol with one-way classical communication |14j . The net key rate 
of proposed protocol and the key rate of the six-state protocol with one-way 
classical communication are compared in Fig. ^ where we assumed the channel 
is the depolarizing channel with q x = q z = qy = P, which indicates that 
the estimated error rates are p z — p x — py — %P- The key rate of the six- 
state protocol that uses B-step of [HI Section 7] optimal times before the error 
correction and the privacy amplification is also plotted in Fig.^ When the error 
rate of the channel is low, the net key rate of the proposed protocol exceeds the 
key rate of the six-state protocol with optimal number of B-steps. 
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Figure 1: Comparison among the net key rate of the proposed protocol, the key 
rate of the six-state protocol with one-way classical communication |14j . and 
the key rate of the six-state protocol with optimal number of B-steps 



5 BB84 protocol with proposed preprocessing 

In this section, we calculate the net key rate of the BB84 protocol with proposed 
processing. The protocol is executed in almost the same way as the protocol in 
Section 0] except the following two changes. 

• Alice uses only |0), |1), |0), and |T) in Step (jTJ. 

• Alice and Bob can get ratios of errors pz and px in Step Thus, Alice 
and Bob have to perform a processing that is secure against the worst case 
of qx — pz~ 1y = OL,qz = px — o. for a parameter a £ [0, min{pz,px}]- 

The net key rate of the BB84 protocol with proposed processing is given by 
l-H(q I ,q x ,qz,qY) + -^-{H[qi,qz]+H[q x ,qY]} ■ (6) 

The net key rate of Eq. © exceed the key rate 

1 - h(Pz) - Kpx) = min [1 - -/?(<?/, q x , qz, qy)] 

a 

of the BB84 protocol with one-way classical communication, where h(-) is the 
binary entropy function. The net key rate of proposed protocol and the key 
rate of the BB84 protocol with one-way classical communication are compared 
in Fig. where we assumed pz = px- The key rate of the BB84 protocol 
that uses B-step of (SJ Section 7] optimal times before the error correction and 
the privacy amplification is also plotted in Fig. [21 When the error rate of the 



9 



channel is low, the net key rate of the proposed protocol exceeds the key rate 
of the BB84 protocol with optimal number of B-steps. 




error rate 



Figure 2: Comparison among the net key rate of the proposed protocol, the key 
rate of the BB84 protocol with one-way classical communication, and the key 
rate of the BB84 protocol with optimal number of B-steps [H] . 



6 Conclusion 

In this paper, we proposed a two-way preprocessing that is assisted by one- 
time pad encryption, and showed that proposed preprocessing is reduced to 
the two-way EDP assisted by previously shared EPR pairs, and the security of 
the QKD with proposed preprocessing is guaranteed in the same way as Shor 
and Preskill's arguments. We also showed that for the six-state protocol and the 
BB84 protocol the net key rate of the QKD with proposed preprocessing exceeds 
the key rate of the QKD with only one-way classical communication, and also 
exceeds the key rate of the QKD with conventional two-way preprocessing when 
the error rate is low. 
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